Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state...

Design/Logic Flaw

The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption involving...

Type confusion

The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML type...

CVE-2013-1802

The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML typ...

UBUNTU-CVE-2013-1802

The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML typ...

UBUNTU-CVE-2013-1800

The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML type...

Type confusion

The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML typ...

CVE-2013-1800

The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML type...

CVE-2013-1802

CVE-2013-1802 concerns the extlib gem for Ruby (0.9.15 and earlier). The vulnerability arises from improper restriction of casts of string values, allowing object-injection and potentially arbitrary code execution or denial of service via YAML type conversion or Symbol type conversion, similar to...

CVE-2013-0285

The CVE-2013-0285 entry concerns the nori gem for Ruby. Affected versions: nori 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3. Root cause: improper restriction of casts for string values during YAML type conversion or Symbol type conversion, enabling remote object-injection attac...

CVE-2013-1801

The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for YAML type...

CVE-2013-0285

The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption involving...

CVE-2013-1802

The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML typ...

CVE-2013-1800

CVE-2013-1800 concerns the crack gem for Ruby (0.3.1 and earlier). The issue arises from improper restriction of casts of string values, enabling potential object-injection and arbitrary code execution, or a denial of service, via Action Pack support for YAML type conversion or Symbol type conver...

CVE-2013-1801

Technical details for CVE-2013-1801 are not publicly available in the provided documents. No vendor/product/version specifics or remediation are disclosed here. Monitor for updates from official sources to obtain concrete details and fixes.

CVE-2012-6134

CVE-2012-6134: CSRF vulnerability in the Ruby gem omniauth-oauth2 (versions 1.1.1 and earlier) allows remote attackers to hijack user authentication for requests that modify session state. Affected component is the omniauth-oauth2 gem for Ruby; root cause is cross-site request forgery. Connected ...

CVE-2013-1898

CVE-2013-1898 affects the Ruby Thumbshooter gem (version 0.1.5) via thumbshooter.rb. The flaw is an input sanitization issue where a URL containing shell metacharacters enables a remote attacker to execute arbitrary commands. The vulnerability arises from insufficient sanitization of URL input, a...

CVE-2013-1802

The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML typ...

PT-2013-3400

Name of the Vulnerable Software and Affected Versions httparty gem version 0.9.0 and earlier Description The issue is related to the improper restriction of casts of string values, which could allow remote attackers to conduct object-injection attacks. This might lead to the execution of arbitrar...

Karteek Docsplit Gem for Ruby text_extractor.rb File Name Shell Metacharacter Injection Arbitrary Command Execution

Karteek Docsplit Gem for Ruby contains a flaw that is due to the program failing to properly sanitize input passed to textextractor.rb. With a specially crafted file name that contains shell metacharacters, a context-dependent attacker can execute arbitrary commands...